проблема с п*рнорекламой

[catanddog06]

У меня та же проблема с порнорекламой!Помогите, пожалуйста!Я все сделала, как у вас на сайте написано, с помощью программы ComboFix, у меня получился log, скажите, пожалуйста, что мне дальше делать.

ComboFix 08-12-07.04 — 1 2008-12-09 23:27:28.5 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1251.1.1049.18.101 [GMT 4:00]
Running from: c:documents and settings1Рабочий столComboFix.exe
Command switches used :: c:documents and settings1Рабочий столCFScript.txt
* Created a new restore point
* Resident AV is active

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
c:windowssystem32nzilib.dll
c:windowssystem32vmelib.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:documents and settings1Local SettingsTemporary Internet Files0EB9F12C_6E6B_4c03_AEBA_8C04CFA98AA4.gif
c:documents and settings1Local SettingsTemporary Internet Files15913497_F86C_4218_8817_F50940D1E1B2.gif
c:documents and settings1Local SettingsTemporary Internet Files29887DDE_00B9_4011_9CF7_59511F1ECC1B.gif
c:documents and settings1Local SettingsTemporary Internet Files2A665EDD_5758_480c_8366_66DFC5F23877.gif
c:documents and settings1Local SettingsTemporary Internet Files35B7DFFA_884F_4fbc_8E60_DA601BDC7BF7.gif
c:documents and settings1Local SettingsTemporary Internet Files362FD6E8_8CDA_4c2a_A8AA-BDA22B321711.jpg
c:documents and settings1Local SettingsTemporary Internet Files3DF04940_9866_4241_A998_0CDDFAFD147A.gif
c:documents and settings1Local SettingsTemporary Internet Files426500D7_0FF3_426c_828D_065DBAEA0581.gif
c:documents and settings1Local SettingsTemporary Internet Files478BD4AE_2691_438d_BDCA_3485DC022700.gif
c:documents and settings1Local SettingsTemporary Internet Files5C6C645F_BAA8_4149_BFEB_2031230FF0FD.gif
c:documents and settings1Local SettingsTemporary Internet Files61EA7D69_19D4_421a_A899_0DF4D58CD119.jpg
c:documents and settings1Local SettingsTemporary Internet Files777FDAFB_83CF_4960_AA71_4E5D7BCD8E57.gif
c:documents and settings1Local SettingsTemporary Internet Files8DA878D5_E80B_4721_B75A_17EFFAF1A700.gif
c:documents and settings1Local SettingsTemporary Internet Files98F6DF79_7171_452d_9C26_C0193E12DBDF.gif
c:documents and settings1Local SettingsTemporary Internet FilesA2B240D6_0386_419e_91C5_3F7D90437CD0.jpg
c:documents and settings1Local SettingsTemporary Internet FilesC75CEF8D_5AF4_4563_8594_C45A45E14E63.gif
c:documents and settings1Local SettingsTemporary Internet FilesE21285C1_40E6_435c_A69F_3387E7BD89CB.gif
c:documents and settings1Local SettingsTemporary Internet FilesE9A4D648_ED73_4ea7_88B2_18332DBA4F3E.jpg

.
((((((((((((((((((((((((( Files Created from 2008-11-09 to 2008-12-09 )))))))))))))))))))))))))))))))
.

2008-12-09 22:15 . 2008-12-09 22:15

d

---

c:program filesICQ6Toolbar
2008-12-09 22:15 . 2008-12-09 22:15 d

---

c:documents and settingsAll UsersApplication DataICQ
2008-12-09 22:12 . 2008-12-09 22:23 d

---

c:program filesICQ6.5
2008-12-09 22:12 . 2008-12-09 22:23 d

---

c:documents and settings1Application DataICQ
2008-12-08 00:28 . 2008-12-08 00:28 d

---

c:documents and settingsЂ¤¬Ё­Ёбва в®а
2008-12-07 23:08 . 2008-12-07 23:08 d

---

c:program filesParagon Software
2008-12-07 23:08 . 2008-12-07 23:08 d

---

c:program filesCommon FilesParagon Software
2008-12-07 22:17 . 2008-12-07 22:17 330,752 —a

---

c:windowssystem32ovylib.dll
2008-12-07 21:31 . 2008-12-07 21:36 d

---

c:program filesTranslateIt! 6.5
2008-12-07 21:31 . 2008-12-07 21:31 d

---

c:program filesMyCentria
2008-12-07 21:31 . 2008-12-07 21:31 d

---

c:documents and settings1Application DataTranslateIt6.5
2008-12-05 21:35 . 2008-12-05 23:01 d

---

c:program filesГДЗометр 2.1
2008-12-03 22:40 . 2008-12-03 22:40 d

---

c:program filesVerseQ
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program filesUltraISO
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program filesSmart Install Maker
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program filesLouderIt
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program filesDAEMON Tools
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program filesCommon FilesEZB Systems
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program filesAudiograbber
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program files7-Zip
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:documents and settings1Application DataDAEMON Tools
2008-11-28 23:35 . 2001-08-17 14:53 62,976 —a

---

c:windowssystem32CABARC.EXE
2008-11-28 23:35 . 2007-10-31 20:42 8,636 —a

---

c:windowssystem32MODIFYPE.EXE
2008-11-28 23:35 . 2007-11-08 15:44 2,130 —a

---

c:windowssystem32CABTOOLS.VBS
2008-11-28 23:35 . 2004-09-28 20:26 1,701 —a

---

c:windowssystem32CABIN.VBS
2008-11-28 23:35 . 2004-09-27 20:57 1,281 —a

---

c:windowssystem32CABOUT.VBS
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesRestorator 2007
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesNeoSmart Technologies
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesFSImgViewer
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesEverest
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesEasy Gif Animator
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesDriver-soft
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesCPU-Z
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:documents and settings1Application DataFastStone
2008-11-28 23:34 . 2007-03-11 21:29 116,736 —a

---

c:windowssystem32RestoratorContextMenu.dll
2008-11-28 23:33 . 2008-11-28 23:33 d

---

c:program filesCorel
2008-11-28 23:33 . 2008-11-28 23:33 d

---

c:program filesCommon FilesCorel
2008-11-28 23:30 . 2008-11-28 23:30 d

---

c:program filesTechSmith
2008-11-28 23:30 . 2008-11-28 23:30 d

---

c:documents and settingsAll UsersApplication DataTechSmith
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesXPTweaker
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesUninstall Tool
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesRegshot
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesReal Alternative
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesNo1 DVD Ripper
2008-11-28 23:29 . 2007-07-09 17:40 d

---

c:program filesKristanix
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesK-Lite Codec Pack
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesCommon FilesWise Installation Wizard
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesCcleaner
2008-11-28 23:28 . 2008-11-28 23:28 d

---

c:program filesVLC
2008-11-28 23:28 . 2008-11-28 23:28 d

---

c:program filesThe KMPlayer
2008-11-28 23:28 . 2008-11-28 23:28 d

---

c:program filesMSECache
2008-11-28 23:27 . 2008-11-28 23:27 d

---

c:program filesCommon FilesMacromedia
2008-11-28 23:27 . 2008-11-28 23:48 d

---

c:program filesCommon FilesArsenal Shared
2008-11-28 23:27 . 2008-11-28 23:28 d

---

c:program filesArsenal Company
2008-11-28 23:25 . 2008-11-28 23:25 d

---

c:program filesMacromedia
2008-11-28 23:17 . 2008-11-28 23:24 d

---

c:windowsSHELLNEW
2008-11-28 23:15 . 2008-11-28 23:15 d

---

c:program filesMicrosoft Works
2008-11-28 23:13 . 2008-11-28 23:25 d

---

c:documents and settingsAll UsersApplication DataMicrosoft Help
2008-11-28 23:12 . 2008-11-28 23:12 dr-h

---

C:MSOCache
2008-11-28 23:11 . 2008-11-28 23:11 d

---

c:program filesWinDjView
2008-11-28 23:11 . 2008-11-28 23:42 d

---

c:program filesPunto Switcher
2008-11-28 23:11 . 2008-11-28 23:11 d

---

c:program filesFoxit Reader
2008-11-27 21:48 . 2008-11-27 23:36 d

---

c:windowssystem32CatRoot_bak
2008-11-27 21:25 . 2008-11-27 21:25 d

---

c:program filesMicrosoft Silverlight
2008-11-27 20:20 . 2004-12-22 13:06 17,584,128 -ra

---

c:windowssystem32ALSNDMGR.CPL
2008-11-27 20:20 . 2004-12-22 13:13 9,524,224 -ra

---

c:windowssystem32RTLCPL.EXE
2008-11-27 20:20 . 2004-12-22 13:07 2,304,320 -ra

---

c:windowssystem32driversALCXWDM.SYS
2008-11-27 20:20 . 2004-09-07 10:23 156,672 -ra

---

c:windowssystem32RTLCPAPI.dll
2008-11-27 20:20 . 2002-02-05 09:54 141,016 -ra

---

c:windowssystem32ALSNDMGR.WAV
2008-11-27 20:20 . 2004-12-22 13:09 77,824 -ra

---

c:windowsSOUNDMAN.EXE
2008-11-27 20:09 . 2008-11-27 20:09 d

---

c:documents and settingsAll UsersApplication DataNetwork Associates
2008-11-27 20:08 . 2008-11-27 20:09 d

---

c:program filesNetwork Associates
2008-11-27 20:08 . 2008-11-27 20:08 d

---

c:program filesCommon FilesNetwork Associates
2008-11-27 19:47 . 2008-11-27 19:48 d

---

c:program filesWinamp
2008-11-27 19:17 . 2008-11-27 19:30 d

---

c:windowsSxsCaPendDel
2008-11-27 19:11 . 2008-11-29 13:28 d

---

c:program filesMario Forever
2008-11-27 17:24 . 2008-11-27 17:24 4,444 —a

---

c:windowssystem32pid.PNF
2008-11-16 19:25 . 2008-10-16 14:06 268,648 —a

---

c:windowssystem32mucltui.dll
2008-11-16 19:25 . 2008-10-16 14:06 208,744 —a

---

c:windowssystem32muweb.dll
2008-11-16 19:25 . 2008-10-16 14:06 27,496 —a

---

c:windowssystem32mucltui.dll.mui
2008-11-14 17:25 . 2008-11-14 17:54 d

---

c:program filesAlawar.ru
2008-11-14 17:25 . 2008-11-15 00:35 d

---

c:documents and settingsAll UsersApplication DataAlawarWrapper
2008-11-14 17:25 . 2008-11-14 17:25 d

---

c:documents and settings1Application DataEleFun Games
2008-11-12 11:29 . 2007-06-26 10:10 1,104,896 —a

---

c:windowssystem32dllcachemsxml3.dll
2008-11-12 11:29 . 2006-05-05 13:41 453,120 —a

---

c:windowssystem32dllcachemrxsmb.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-09 18:15

---

d—h—w c:program filesInstallShield Installation Information
2008-12-09 17:43

---

d

---

w c:program filesQIP
2008-11-28 19:31

---

d

---

w c:program filesCommon FilesAdobe
2008-11-27 15:47

---

d

---

w c:program filesDownload Master
2008-11-27 15:36

---

d

---

w c:program filesNokia
2008-11-27 15:31

---

d

---

w c:program filesMail.Ru
2008-11-27 15:30 96,256 —-a-w c:windowssystem32driverssptd5581.sys
2008-11-27 15:28

---

d

---

w c:program filescitysvyaz
2008-11-27 15:27

---

d

---

w c:program filesPPPWorld
2008-11-27 15:27

---

d

---

w c:program filesDivX
2008-11-27 15:26

---

d

---

w c:program filesXtra
2008-11-27 15:19

---

d

---

w c:program filesOpera
2008-11-27 15:05

---

d

---

w c:program filesInterActual
2008-11-27 15:04

---

d

---

w c:program filesInterVideo
2008-11-27 15:04

---

d

---

w c:program filesCommon FilesInterVideo
2008-11-27 15:01

---

d

---

w c:program filesASUSTek
2008-10-16 10:13 202,776 —-a-w c:windowssystem32wuweb.dll
2008-10-16 10:13 1,809,944 —-a-w c:windowssystem32wuaueng.dll
2008-10-16 10:12 561,688 —-a-w c:windowssystem32wuapi.dll
2008-10-16 10:12 323,608 —-a-w c:windowssystem32wucltui.dll
2008-10-16 10:09 92,696 —-a-w c:windowssystem32cdm.dll
2008-10-16 10:09 51,224 —-a-w c:windowssystem32wuauclt.exe
2008-10-16 10:09 43,544 —-a-w c:windowssystem32wups2.dll
2008-10-16 10:08 34,328 —-a-w c:windowssystem32wups.dll
2008-10-15 17:00 332,800 —-a-w c:windowssystem32dllcachenetapi32.dll
2008-09-30 12:43 1,286,152 —-a-w c:windowssystem32msxml4.dll
2008-09-15 15:40 1,846,144 —-a-w c:windowssystem32win32k.sys
2008-09-15 15:40 1,846,144 —-a-w c:windowssystem32dllcachewin32k.sys
2006-02-23 20:00 4,400,769 —-a-w c:program files3gp-video-converter.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE~Browser Helper Objects{AB95711E-261B-4D76-A421-080BFC64861D}]
2008-12-07 22:17 330752 —a

---

c:windowssystem32ovylib.dll

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2004-08-17 15360]
«NBJ»=»c:program filesaheadNero BackItUpNBJ.exe» [2004-09-07 1871872]
«MSMSGS»=»c:program filesMessengermsmsgs.exe» [2004-10-13 1694208]
«Download Master»=»c:program filesDownload Masterdmaster.exe» [2007-09-12 3253248]
«PcSync»=»c:program filesNokiaNokia PC Suite 6PcSync2.exe» [2006-06-27 1449984]
«Punto Switcher»=»c:program filesPunto Switcherps.exe» [2007-11-14 201728]
«louderit.exe»=»c:program fileslouderitLouderIt.exe» [2008-02-19 41472]
«SlovoEd 6″=»c:program filesParagon SoftwareSlovoEd 6run.exe» [2007-03-26 610304]
«ICQ»=»c:program filesICQ6.5ICQ.exe» [2008-11-30 172792]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«NeroFilterCheck»=»c:windowssystem32NeroCheck.exe» [2001-07-09 155648]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2005-06-15 6803456]
«PCSuiteTrayApplication»=»c:progra~1NokiaNOKIAP~1LAUNCH~1.EXE» [2006-06-15 229376]
«WinampAgent»=»c:program filesWinampwinampa.exe» [2006-02-23 35328]
«ShStatEXE»=»c:program filesNetwork AssociatesVirusScanSHSTAT.EXE» [2003-09-29 81990]
«McAfeeUpdaterUI»=»c:program filesNetwork AssociatesCommon FrameworkUpdaterUI.exe» [2003-09-10 135251]
«nwiz»=»nwiz.exe» [2005-06-15 c:windowssystem32nwiz.exe]
«SoundMan»=»SOUNDMAN.EXE» [2004-12-22 c:windowsSOUNDMAN.EXE]

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\QIP\qip.exe»=
«c:\Program Files\ICQ6.5\ICQ.exe»=

R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);c:windowssystem32driverssfsync03.sys [2005-12-06 35328]
R0 tffsport;M-Systems DiskOnChip 2000;c:windowssystem32DRIVERStffsport.sys [2008-10-28 149376]
R2 ICQ Service;ICQ Service;c:program filesICQ6ToolbarICQ Service.exe [2008-12-09 222456]
S3 ASPI;Advanced SCSI Programming Interface Driver;??c:windowsSystem32DRIVERSASPI32.sys [2008-02-04 16512]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2F]
ShellAutoRuncommand — F:laucher.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{37756303-b63a-11dd-b83d-001485192de9}]
ShellAutoRuncommand — H:rqq2v.bat
ShellexploreCommand — H:rqq2v.bat
ShellopenCommand — H:rqq2v.bat

*Newly Created Service* — ICQ_SERVICE
.
— — — — ORPHANS REMOVED — — — —

WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} — (no file)

.

---

Supplementary Scan

---

.
uStart Page = hxxp://www.yandex.ru/?clid=40488
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~4Office12EXCEL.EXE/3000
IE: Закачать ВСЕ при помощи Download Master — c:program filesDownload Masterdmieall.htm
IE: Закачать при помощи Download Master — c:program filesDownload Masterdmie.htm
IE: {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — c:program filesDownload Masterdmaster.exe
IE: {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — c:program filesDownload Masterdmaster.exe —
TCP: {ECABB36C-1AA3-40EC-AE20-2881C213519F} = 85.113.62.225 85.113.63.225
FireFox -: Profile — c:documents and settings1Application DataMozillaFirefoxProfilesh3beukur.default
FireFox -: prefs.js — STARTUP.HOMEPAGE — hxxp://www.yandex.ru/?clid=40488
FF -: plugin — c:program filesK-Lite Codec PackRealbrowserpluginsnppl3260.dll
FF -: plugin — c:program filesK-Lite Codec PackRealbrowserpluginsnprpjplug.dll
FF -: plugin — c:program filesMicrosoft Silverlight2.0.31005.0npctrl.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-09 23:29:38
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-12-09 23:30:48
ComboFix-quarantined-files.txt 2008-12-09 19:30:14
ComboFix2.txt 2008-12-08 18:22:57
ComboFix3.txt 2008-12-08 13:03:41
ComboFix4.txt 2008-12-07 20:28:17

Pre-Run: 19 546 898 432 байт свободно
Post-Run: 19,544,023,040 байт свободно

230 — E O F — 2008-10-24 18:01:10

[Admin]

Здравствуйте, добро пожаловать на Spyware-ru форум.

Кроме паразита показывающего рекламу, ваш компьютер заражён autorun.inf вирусом.
Прочитайте эту инструкцию Flash_Disinfector ещё одно оружие против autorun.inf троянов. Скачайте и запустите Flash_Disinfector, не забудьте при этом по требованию программы вставить ваш флэш диск или подключить другие внешние устройства хранения информации.

Далее, откройте блокнот и вставьте в него следующий текст:

Registry::

[-HKEY_LOCAL_MACHINE~Browser Helper Objects{AB95711E-261B-4D76-A421-080BFC64861D}]



File::

c:windowssystem32ovylib.dll



Folder::

c:program filesMyCentria

Запишите получившийся файл на ваш рабочий стол под именем CFScript
Далее перетащите получившийся файл на иконку Combofix, как показано на картинке ниже.

Сombofix запуститься и выполнит процедуры описанные в созданном нами файле.
По результатам работы Combofix будет создан новый лог, его и вставьте в свой следующий ответ (отвечайте в этой же теме).
И конечно-же проверьте наличие рекламы.

[catanddog06]

Я все сделала, как Вы написали.Порнореклама пропала!!!Спасибо огромное!Не знаю, надо Вам теперь лог отправлять или нет, но на всякий случай отправляю.Дальше надо что-нибудь делать?

ComboFix 08-12-14.01 — 1 2008-12-14 21:50:23.6 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1251.1.1049.18.511.151 [GMT 4:00]
Running from: c:documents and settings1Рабочий столComboFix.exe
Command switches used :: c:documents and settings1Рабочий столCFScript.txt
* Created a new restore point
* Resident AV is active

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
c:windowssystem32ovylib.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:documents and settings1Local SettingsTemporary Internet Files0EB9F12C_6E6B_4c03_AEBA_8C04CFA98AA4.gif
c:documents and settings1Local SettingsTemporary Internet Files15913497_F86C_4218_8817_F50940D1E1B2.gif
c:documents and settings1Local SettingsTemporary Internet Files29887DDE_00B9_4011_9CF7_59511F1ECC1B.gif
c:documents and settings1Local SettingsTemporary Internet Files2A665EDD_5758_480c_8366_66DFC5F23877.gif
c:documents and settings1Local SettingsTemporary Internet Files35B7DFFA_884F_4fbc_8E60_DA601BDC7BF7.gif
c:documents and settings1Local SettingsTemporary Internet Files362FD6E8_8CDA_4c2a_A8AA-BDA22B321711.jpg
c:documents and settings1Local SettingsTemporary Internet Files3DF04940_9866_4241_A998_0CDDFAFD147A.gif
c:documents and settings1Local SettingsTemporary Internet Files426500D7_0FF3_426c_828D_065DBAEA0581.gif
c:documents and settings1Local SettingsTemporary Internet Files478BD4AE_2691_438d_BDCA_3485DC022700.gif
c:documents and settings1Local SettingsTemporary Internet Files5C6C645F_BAA8_4149_BFEB_2031230FF0FD.gif
c:documents and settings1Local SettingsTemporary Internet Files61EA7D69_19D4_421a_A899_0DF4D58CD119.jpg
c:documents and settings1Local SettingsTemporary Internet Files777FDAFB_83CF_4960_AA71_4E5D7BCD8E57.gif
c:documents and settings1Local SettingsTemporary Internet Files8DA878D5_E80B_4721_B75A_17EFFAF1A700.gif
c:documents and settings1Local SettingsTemporary Internet Files98F6DF79_7171_452d_9C26_C0193E12DBDF.gif
c:documents and settings1Local SettingsTemporary Internet FilesA2B240D6_0386_419e_91C5_3F7D90437CD0.jpg
c:documents and settings1Local SettingsTemporary Internet FilesC75CEF8D_5AF4_4563_8594_C45A45E14E63.gif
c:documents and settings1Local SettingsTemporary Internet FilesE21285C1_40E6_435c_A69F_3387E7BD89CB.gif
c:documents and settings1Local SettingsTemporary Internet FilesE9A4D648_ED73_4ea7_88B2_18332DBA4F3E.jpg
c:program filesMyCentria
c:program filesMyCentriaFirefoxadcentria.uid
c:program filesMyCentriaFirefoxadcentria.xml
c:program filesMyCentriaFirefoxInstallerFF.exe
c:program filesMyCentriaInfoBarMyCentriaInfoBar.dll
c:program filesMyCentriaMyCentriaUninstall.exe
c:windowssystem32ovylib.dll

.
((((((((((((((((((((((((( Files Created from 2008-11-14 to 2008-12-14 )))))))))))))))))))))))))))))))
.

2008-12-10 19:21 . 2008-12-10 19:21 796 —a

---

C:top100.cnt
2008-12-09 22:15 . 2008-12-09 22:15 d

---

c:program filesICQ6Toolbar
2008-12-09 22:15 . 2008-12-09 22:15 d

---

c:documents and settingsAll UsersApplication DataICQ
2008-12-09 22:12 . 2008-12-09 22:23 d

---

c:program filesICQ6.5
2008-12-09 22:12 . 2008-12-13 19:12 d

---

c:documents and settings1Application DataICQ
2008-12-08 00:28 . 2008-12-08 22:22 d

---

c:documents and settingsЂ¤¬Ё­Ёбва в®аLocal Settings
2008-12-08 00:28 . 2008-12-08 00:28 d

---

c:documents and settingsЂ¤¬Ё­Ёбва в®а
2008-12-07 23:08 . 2008-12-07 23:08 d

---

c:program filesParagon Software
2008-12-07 23:08 . 2008-12-07 23:08 d

---

c:program filesCommon FilesParagon Software
2008-12-07 21:31 . 2008-12-07 21:36 d

---

c:program filesTranslateIt! 6.5
2008-12-07 21:31 . 2008-12-07 21:31 d

---

c:documents and settings1Application DataTranslateIt6.5
2008-12-05 21:35 . 2008-12-05 23:01 d

---

c:program filesГДЗометр 2.1
2008-12-03 22:40 . 2008-12-03 22:40 d

---

c:program filesVerseQ
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program filesUltraISO
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program filesSmart Install Maker
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program filesLouderIt
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program filesDAEMON Tools
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program filesCommon FilesEZB Systems
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program filesAudiograbber
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program files7-Zip
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:documents and settings1Application DataDAEMON Tools
2008-11-28 23:35 . 2001-08-17 14:53 62,976 —a

---

c:windowssystem32CABARC.EXE
2008-11-28 23:35 . 2007-10-31 20:42 8,636 —a

---

c:windowssystem32MODIFYPE.EXE
2008-11-28 23:35 . 2007-11-08 15:44 2,130 —a

---

c:windowssystem32CABTOOLS.VBS
2008-11-28 23:35 . 2004-09-28 20:26 1,701 —a

---

c:windowssystem32CABIN.VBS
2008-11-28 23:35 . 2004-09-27 20:57 1,281 —a

---

c:windowssystem32CABOUT.VBS
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesRestorator 2007
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesNeoSmart Technologies
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesFSImgViewer
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesEverest
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesEasy Gif Animator
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesDriver-soft
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesCPU-Z
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:documents and settings1Application DataFastStone
2008-11-28 23:34 . 2007-03-11 21:29 116,736 —a

---

c:windowssystem32RestoratorContextMenu.dll
2008-11-28 23:33 . 2008-11-28 23:33 d

---

c:program filesCorel
2008-11-28 23:33 . 2008-11-28 23:33 d

---

c:program filesCommon FilesCorel
2008-11-28 23:30 . 2008-11-28 23:30 d

---

c:program filesTechSmith
2008-11-28 23:30 . 2008-11-28 23:30 d

---

c:documents and settingsAll UsersApplication DataTechSmith
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesXPTweaker
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesUninstall Tool
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesRegshot
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesReal Alternative
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesNo1 DVD Ripper
2008-11-28 23:29 . 2007-07-09 17:40 d

---

c:program filesKristanix
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesK-Lite Codec Pack
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesCommon FilesWise Installation Wizard
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesCcleaner
2008-11-28 23:28 . 2008-11-28 23:28 d

---

c:program filesVLC
2008-11-28 23:28 . 2008-11-28 23:28 d

---

c:program filesThe KMPlayer
2008-11-28 23:28 . 2008-11-28 23:28 d

---

c:program filesMSECache
2008-11-28 23:27 . 2008-11-28 23:27 d

---

c:program filesCommon FilesMacromedia
2008-11-28 23:27 . 2008-11-28 23:48 d

---

c:program filesCommon FilesArsenal Shared
2008-11-28 23:27 . 2008-11-28 23:28 d

---

c:program filesArsenal Company
2008-11-28 23:25 . 2008-11-28 23:25 d

---

c:program filesMacromedia
2008-11-28 23:17 . 2008-11-28 23:24 d

---

c:windowsSHELLNEW
2008-11-28 23:15 . 2008-11-28 23:15 d

---

c:program filesMicrosoft Works
2008-11-28 23:13 . 2008-11-28 23:25 d

---

c:documents and settingsAll UsersApplication DataMicrosoft Help
2008-11-28 23:12 . 2008-11-28 23:12 dr-h

---

C:MSOCache
2008-11-28 23:11 . 2008-11-28 23:11 d

---

c:program filesWinDjView
2008-11-28 23:11 . 2008-11-28 23:42 d

---

c:program filesPunto Switcher
2008-11-28 23:11 . 2008-11-28 23:11 d

---

c:program filesFoxit Reader
2008-11-27 21:48 . 2008-11-27 23:36 d

---

c:windowssystem32CatRoot_bak
2008-11-27 21:25 . 2008-11-27 21:25 d

---

c:program filesMicrosoft Silverlight
2008-11-27 20:20 . 2004-12-22 13:06 17,584,128 -ra

---

c:windowssystem32ALSNDMGR.CPL
2008-11-27 20:20 . 2004-12-22 13:13 9,524,224 -ra

---

c:windowssystem32RTLCPL.EXE
2008-11-27 20:20 . 2004-12-22 13:07 2,304,320 -ra

---

c:windowssystem32driversALCXWDM.SYS
2008-11-27 20:20 . 2004-09-07 10:23 156,672 -ra

---

c:windowssystem32RTLCPAPI.dll
2008-11-27 20:20 . 2002-02-05 09:54 141,016 -ra

---

c:windowssystem32ALSNDMGR.WAV
2008-11-27 20:20 . 2004-12-22 13:09 77,824 -ra

---

c:windowsSOUNDMAN.EXE
2008-11-27 20:09 . 2008-11-27 20:09 d

---

c:documents and settingsAll UsersApplication DataNetwork Associates
2008-11-27 20:08 . 2008-11-27 20:09 d

---

c:program filesNetwork Associates
2008-11-27 20:08 . 2008-11-27 20:08 d

---

c:program filesCommon FilesNetwork Associates
2008-11-27 19:47 . 2008-11-27 19:48 d

---

c:program filesWinamp
2008-11-27 19:17 . 2008-11-27 19:30 d

---

c:windowsSxsCaPendDel
2008-11-27 19:11 . 2008-11-29 13:28 d

---

c:program filesMario Forever
2008-11-27 17:24 . 2008-11-27 17:24 4,444 —a

---

c:windowssystem32pid.PNF
2008-11-16 19:25 . 2008-10-16 14:06 268,648 —a

---

c:windowssystem32mucltui.dll
2008-11-16 19:25 . 2008-10-16 14:06 208,744 —a

---

c:windowssystem32muweb.dll
2008-11-16 19:25 . 2008-10-16 14:06 27,496 —a

---

c:windowssystem32mucltui.dll.mui
2008-11-14 17:25 . 2008-11-14 17:54 d

---

c:program filesAlawar.ru
2008-11-14 17:25 . 2008-11-15 00:35 d

---

c:documents and settingsAll UsersApplication DataAlawarWrapper
2008-11-14 17:25 . 2008-11-14 17:25 d

---

c:documents and settings1Application DataEleFun Games

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-09 18:15

---

d—h—w c:program filesInstallShield Installation Information
2008-12-09 17:43

---

d

---

w c:program filesQIP
2008-11-28 19:31

---

d

---

w c:program filesCommon FilesAdobe
2008-11-27 15:47

---

d

---

w c:program filesDownload Master
2008-11-27 15:36

---

d

---

w c:program filesNokia
2008-11-27 15:31

---

d

---

w c:program filesMail.Ru
2008-11-27 15:30 96,256 —-a-w c:windowssystem32driverssptd5581.sys
2008-11-27 15:28

---

d

---

w c:program filescitysvyaz
2008-11-27 15:27

---

d

---

w c:program filesPPPWorld
2008-11-27 15:27

---

d

---

w c:program filesDivX
2008-11-27 15:26

---

d

---

w c:program filesXtra
2008-11-27 15:19

---

d

---

w c:program filesOpera
2008-11-27 15:05

---

d

---

w c:program filesInterActual
2008-11-27 15:04

---

d

---

w c:program filesInterVideo
2008-11-27 15:04

---

d

---

w c:program filesCommon FilesInterVideo
2008-11-27 15:01

---

d

---

w c:program filesASUSTek
2008-10-16 10:13 202,776 —-a-w c:windowssystem32wuweb.dll
2008-10-16 10:13 1,809,944 —-a-w c:windowssystem32wuaueng.dll
2008-10-16 10:12 561,688 —-a-w c:windowssystem32wuapi.dll
2008-10-16 10:12 323,608 —-a-w c:windowssystem32wucltui.dll
2008-10-16 10:09 92,696 —-a-w c:windowssystem32cdm.dll
2008-10-16 10:09 51,224 —-a-w c:windowssystem32wuauclt.exe
2008-10-16 10:09 43,544 —-a-w c:windowssystem32wups2.dll
2008-10-16 10:08 34,328 —-a-w c:windowssystem32wups.dll
2008-10-15 17:00 332,800 —-a-w c:windowssystem32dllcachenetapi32.dll
2008-09-30 12:43 1,286,152 —-a-w c:windowssystem32msxml4.dll
2008-09-15 15:40 1,846,144 —-a-w c:windowssystem32win32k.sys
2008-09-15 15:40 1,846,144 —-a-w c:windowssystem32dllcachewin32k.sys
2006-02-23 20:00 4,400,769 —-a-w c:program files3gp-video-converter.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2004-08-17 15360]
«NBJ»=»c:program filesaheadNero BackItUpNBJ.exe» [2004-09-07 1871872]
«MSMSGS»=»c:program filesMessengermsmsgs.exe» [2004-10-13 1694208]
«Download Master»=»c:program filesDownload Masterdmaster.exe» [2007-09-12 3253248]
«PcSync»=»c:program filesNokiaNokia PC Suite 6PcSync2.exe» [2006-06-27 1449984]
«Punto Switcher»=»c:program filesPunto Switcherps.exe» [2007-11-14 201728]
«louderit.exe»=»c:program fileslouderitLouderIt.exe» [2008-02-19 41472]
«SlovoEd 6″=»c:program filesParagon SoftwareSlovoEd 6run.exe» [2007-03-26 610304]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«NeroFilterCheck»=»c:windowssystem32NeroCheck.exe» [2001-07-09 155648]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2005-06-15 6803456]
«PCSuiteTrayApplication»=»c:progra~1NokiaNOKIAP~1LAUNCH~1.EXE» [2006-06-15 229376]
«WinampAgent»=»c:program filesWinampwinampa.exe» [2006-02-23 35328]
«ShStatEXE»=»c:program filesNetwork AssociatesVirusScanSHSTAT.EXE» [2003-09-29 81990]
«McAfeeUpdaterUI»=»c:program filesNetwork AssociatesCommon FrameworkUpdaterUI.exe» [2003-09-10 135251]
«nwiz»=»nwiz.exe» [2005-06-15 c:windowssystem32nwiz.exe]
«SoundMan»=»SOUNDMAN.EXE» [2004-12-22 c:windowsSOUNDMAN.EXE]

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\QIP\qip.exe»=
«c:\Program Files\ICQ6.5\ICQ.exe»=

R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);c:windowssystem32driverssfsync03.sys [2005-12-06 35328]
R0 tffsport;M-Systems DiskOnChip 2000;c:windowssystem32DRIVERStffsport.sys [2008-10-28 149376]
R2 ICQ Service;ICQ Service;c:program filesICQ6ToolbarICQ Service.exe [2008-12-09 222456]
S3 ASPI;Advanced SCSI Programming Interface Driver;??c:windowsSystem32DRIVERSASPI32.sys [2008-02-04 16512]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2F]
ShellAutoRuncommand — F:laucher.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{37756303-b63a-11dd-b83d-001485192de9}]
ShellAutoRuncommand — H:rqq2v.bat
ShellexploreCommand — H:rqq2v.bat
ShellopenCommand — H:rqq2v.bat
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://www.yandex.ru/?clid=40488
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~4Office12EXCEL.EXE/3000
IE: Закачать ВСЕ при помощи Download Master — c:program filesDownload Masterdmieall.htm
IE: Закачать при помощи Download Master — c:program filesDownload Masterdmie.htm
IE: {{8DAE90AD-4583-4977-9DD4-4360F7A45C74} — c:program filesDownload Masterdmaster.exe
IE: {{8DAE90AD-4583-4977-9DD4-4360F7A45C74} — c:program filesDownload Masterdmaster.exe —
TCP: {ECABB36C-1AA3-40EC-AE20-2881C213519F} = 85.113.62.225 85.113.63.225
FF — ProfilePath — c:documents and settings1Application DataMozillaFirefoxProfilesh3beukur.default
FF — prefs.js: browser.search.selectedEngine — ICQ Search
FF — prefs.js: browser.startup.homepage — hxxp://www.yandex.ru/?clid=40488
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnppl3260.dll
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnprpjplug.dll
FF — plugin: c:program filesMicrosoft Silverlight2.0.31005.0npctrl.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-14 21:52:42
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-12-14 21:53:53
ComboFix-quarantined-files.txt 2008-12-14 17:53:20
ComboFix2.txt 2008-12-09 19:30:50
ComboFix3.txt 2008-12-08 18:22:57
ComboFix4.txt 2008-12-08 13:03:41
ComboFix5.txt 2008-12-14 17:49:32

Pre-Run: 19 125 231 616 байт свободно
Post-Run: 19,358,703,616 байт свободно

230 — E O F — 2008-10-24 18:01:10

[Admin]

Лог выглядит получше чем было ранее.
Но нужно ещё удалить из реестра один ключ, оставленный autorun.inf вирусом.
Откройте блокнот и вставьте в него следующий текст:

Registry::

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{37756303-b63a-11dd-b83d-001485192de9}]

Запишите получившийся файл на ваш рабочий стол под именем CFScript
Далее перетащите получившийся файл на иконку Combofix.

После окончания работы программы будет показан новый лог, вставьте его в ваше следующее сообщение.

[catanddog06]

Все сделала, вот какой Лог получился:

ComboFix 08-12-14.01 — 1 2008-12-22 22:38:47.7 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1251.1.1049.18.511.201 [GMT 4:00]
Running from: c:documents and settings1Рабочий столComboFix.exe
Command switches used :: c:documents and settings1Рабочий столCFScript.txt
* Created a new restore point
* Resident AV is active

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
— REDUCED FUNCTIONALITY MODE —
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:windowssystem32amvo.exe
c:windowssystem32amvo0.dll

.
((((((((((((((((((((((((( Files Created from 2008-11-22 to 2008-12-22 )))))))))))))))))))))))))))))))
.

2008-12-18 14:35 . 2007-12-11 15:12 123,551 -r-hs—- C:n1deiect.com
2008-12-10 19:21 . 2008-12-10 19:21 796 —a

---

C:top100.cnt
2008-12-09 22:15 . 2008-12-09 22:15 d

---

c:program filesICQ6Toolbar
2008-12-09 22:15 . 2008-12-09 22:15 d

---

c:documents and settingsAll UsersApplication DataICQ
2008-12-09 22:12 . 2008-12-09 22:23 d

---

c:program filesICQ6.5
2008-12-09 22:12 . 2008-12-13 19:12 d

---

c:documents and settings1Application DataICQ
2008-12-08 00:28 . 2008-12-08 22:22 d

---

c:documents and settingsЂ¤¬Ё­Ёбва в®аLocal Settings
2008-12-08 00:28 . 2008-12-08 00:28 d

---

c:documents and settingsЂ¤¬Ё­Ёбва в®а
2008-12-07 23:08 . 2008-12-07 23:08 d

---

c:program filesParagon Software
2008-12-07 23:08 . 2008-12-07 23:08 d

---

c:program filesCommon FilesParagon Software
2008-12-07 21:31 . 2008-12-07 21:36 d

---

c:program filesTranslateIt! 6.5
2008-12-07 21:31 . 2008-12-07 21:31 d

---

c:documents and settings1Application DataTranslateIt6.5
2008-12-05 21:35 . 2008-12-05 23:01 d

---

c:program filesГДЗометр 2.1
2008-12-03 22:40 . 2008-12-03 22:40 d

---

c:program filesVerseQ
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program filesUltraISO
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program filesSmart Install Maker
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program filesLouderIt
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program filesDAEMON Tools
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program filesCommon FilesEZB Systems
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program filesAudiograbber
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program files7-Zip
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:documents and settings1Application DataDAEMON Tools
2008-11-28 23:35 . 2001-08-17 14:53 62,976 —a

---

c:windowssystem32CABARC.EXE
2008-11-28 23:35 . 2007-10-31 20:42 8,636 —a

---

c:windowssystem32MODIFYPE.EXE
2008-11-28 23:35 . 2007-11-08 15:44 2,130 —a

---

c:windowssystem32CABTOOLS.VBS
2008-11-28 23:35 . 2004-09-28 20:26 1,701 —a

---

c:windowssystem32CABIN.VBS
2008-11-28 23:35 . 2004-09-27 20:57 1,281 —a

---

c:windowssystem32CABOUT.VBS
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesRestorator 2007
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesNeoSmart Technologies
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesFSImgViewer
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesEverest
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesEasy Gif Animator
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesDriver-soft
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesCPU-Z
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:documents and settings1Application DataFastStone
2008-11-28 23:34 . 2007-03-11 21:29 116,736 —a

---

c:windowssystem32RestoratorContextMenu.dll
2008-11-28 23:33 . 2008-11-28 23:33 d

---

c:program filesCorel
2008-11-28 23:33 . 2008-11-28 23:33 d

---

c:program filesCommon FilesCorel
2008-11-28 23:30 . 2008-11-28 23:30 d

---

c:program filesTechSmith
2008-11-28 23:30 . 2008-11-28 23:30 d

---

c:documents and settingsAll UsersApplication DataTechSmith
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesXPTweaker
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesUninstall Tool
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesRegshot
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesReal Alternative
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesNo1 DVD Ripper
2008-11-28 23:29 . 2007-07-09 17:40 d

---

c:program filesKristanix
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesK-Lite Codec Pack
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesCommon FilesWise Installation Wizard
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesCcleaner
2008-11-28 23:28 . 2008-11-28 23:28 d

---

c:program filesVLC
2008-11-28 23:28 . 2008-11-28 23:28 d

---

c:program filesThe KMPlayer
2008-11-28 23:28 . 2008-11-28 23:28 d

---

c:program filesMSECache
2008-11-28 23:27 . 2008-11-28 23:27 d

---

c:program filesCommon FilesMacromedia
2008-11-28 23:27 . 2008-11-28 23:48 d

---

c:program filesCommon FilesArsenal Shared
2008-11-28 23:27 . 2008-11-28 23:28 d

---

c:program filesArsenal Company
2008-11-28 23:25 . 2008-11-28 23:25 d

---

c:program filesMacromedia
2008-11-28 23:17 . 2008-11-28 23:24 d

---

c:windowsSHELLNEW
2008-11-28 23:15 . 2008-11-28 23:15 d

---

c:program filesMicrosoft Works
2008-11-28 23:13 . 2008-11-28 23:25 d

---

c:documents and settingsAll UsersApplication DataMicrosoft Help
2008-11-28 23:12 . 2008-11-28 23:12 dr-h

---

C:MSOCache
2008-11-28 23:11 . 2008-11-28 23:11 d

---

c:program filesWinDjView
2008-11-28 23:11 . 2008-11-28 23:42 d

---

c:program filesPunto Switcher
2008-11-28 23:11 . 2008-11-28 23:11 d

---

c:program filesFoxit Reader
2008-11-27 21:48 . 2008-11-27 23:36 d

---

c:windowssystem32CatRoot_bak
2008-11-27 21:25 . 2008-11-27 21:25 d

---

c:program filesMicrosoft Silverlight
2008-11-27 20:20 . 2004-12-22 13:06 17,584,128 -ra

---

c:windowssystem32ALSNDMGR.CPL
2008-11-27 20:20 . 2004-12-22 13:13 9,524,224 -ra

---

c:windowssystem32RTLCPL.EXE
2008-11-27 20:20 . 2004-12-22 13:07 2,304,320 -ra

---

c:windowssystem32driversALCXWDM.SYS
2008-11-27 20:20 . 2004-09-07 10:23 156,672 -ra

---

c:windowssystem32RTLCPAPI.dll
2008-11-27 20:20 . 2002-02-05 09:54 141,016 -ra

---

c:windowssystem32ALSNDMGR.WAV
2008-11-27 20:20 . 2004-12-22 13:09 77,824 -ra

---

c:windowsSOUNDMAN.EXE
2008-11-27 20:09 . 2008-11-27 20:09 d

---

c:documents and settingsAll UsersApplication DataNetwork Associates
2008-11-27 20:08 . 2008-11-27 20:09 d

---

c:program filesNetwork Associates
2008-11-27 20:08 . 2008-11-27 20:08 d

---

c:program filesCommon FilesNetwork Associates
2008-11-27 19:47 . 2008-11-27 19:48 d

---

c:program filesWinamp
2008-11-27 19:17 . 2008-11-27 19:30 d

---

c:windowsSxsCaPendDel
2008-11-27 19:11 . 2008-11-29 13:28 d

---

c:program filesMario Forever
2008-11-27 17:24 . 2008-11-27 17:24 4,444 —a

---

c:windowssystem32pid.PNF

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-09 18:15

---

d—h—w c:program filesInstallShield Installation Information
2008-12-09 17:43

---

d

---

w c:program filesQIP
2008-11-28 19:31

---

d

---

w c:program filesCommon FilesAdobe
2008-11-27 15:47

---

d

---

w c:program filesDownload Master
2008-11-27 15:36

---

d

---

w c:program filesNokia
2008-11-27 15:31

---

d

---

w c:program filesMail.Ru
2008-11-27 15:30 96,256 —-a-w c:windowssystem32driverssptd5581.sys
2008-11-27 15:28

---

d

---

w c:program filescitysvyaz
2008-11-27 15:27

---

d

---

w c:program filesPPPWorld
2008-11-27 15:27

---

d

---

w c:program filesDivX
2008-11-27 15:26

---

d

---

w c:program filesXtra
2008-11-27 15:19

---

d

---

w c:program filesOpera
2008-11-27 15:05

---

d

---

w c:program filesInterActual
2008-11-27 15:04

---

d

---

w c:program filesInterVideo
2008-11-27 15:04

---

d

---

w c:program filesCommon FilesInterVideo
2008-11-27 15:01

---

d

---

w c:program filesASUSTek
2008-11-14 20:35

---

d

---

w c:documents and settingsAll UsersApplication DataAlawarWrapper
2008-11-14 13:54

---

d

---

w c:program filesAlawar.ru
2008-11-14 13:25

---

d

---

w c:documents and settings1Application DataEleFun Games
2006-02-23 20:00 4,400,769 —-a-w c:program files3gp-video-converter.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2004-08-17 15360]
«NBJ»=»c:program filesaheadNero BackItUpNBJ.exe» [2004-09-07 1871872]
«MSMSGS»=»c:program filesMessengermsmsgs.exe» [2004-10-13 1694208]
«Download Master»=»c:program filesDownload Masterdmaster.exe» [2007-09-12 3253248]
«PcSync»=»c:program filesNokiaNokia PC Suite 6PcSync2.exe» [2006-06-27 1449984]
«Punto Switcher»=»c:program filesPunto Switcherps.exe» [2007-11-14 201728]
«louderit.exe»=»c:program fileslouderitLouderIt.exe» [2008-02-19 41472]
«SlovoEd 6″=»c:program filesParagon SoftwareSlovoEd 6run.exe» [2007-03-26 610304]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«NeroFilterCheck»=»c:windowssystem32NeroCheck.exe» [2001-07-09 155648]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2005-06-15 6803456]
«PCSuiteTrayApplication»=»c:progra~1NokiaNOKIAP~1LAUNCH~1.EXE» [2006-06-15 229376]
«WinampAgent»=»c:program filesWinampwinampa.exe» [2006-02-23 35328]
«ShStatEXE»=»c:program filesNetwork AssociatesVirusScanSHSTAT.EXE» [2003-09-29 81990]
«McAfeeUpdaterUI»=»c:program filesNetwork AssociatesCommon FrameworkUpdaterUI.exe» [2003-09-10 135251]
«nwiz»=»nwiz.exe» [2005-06-15 c:windowssystem32nwiz.exe]
«SoundMan»=»SOUNDMAN.EXE» [2004-12-22 c:windowsSOUNDMAN.EXE]

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\QIP\qip.exe»=
«c:\Program Files\ICQ6.5\ICQ.exe»=

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2F]
ShellAutoRuncommand — F:laucher.exe
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://www.yandex.ru/?clid=40488
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~4Office12EXCEL.EXE/3000
IE: Закачать ВСЕ при помощи Download Master — c:program filesDownload Masterdmieall.htm
IE: Закачать при помощи Download Master — c:program filesDownload Masterdmie.htm
IE: {{8DAE90AD-4583-4977-9DD4-4360F7A45C74} — c:program filesDownload Masterdmaster.exe
IE: {{8DAE90AD-4583-4977-9DD4-4360F7A45C74} — c:program filesDownload Masterdmaster.exe —
FF — ProfilePath — c:documents and settings1Application DataMozillaFirefoxProfilesh3beukur.default
FF — prefs.js: browser.search.selectedEngine — ICQ Search
FF — prefs.js: browser.startup.homepage — hxxp://www.yandex.ru/?clid=40488
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnppl3260.dll
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnprpjplug.dll
FF — plugin: c:program filesMicrosoft Silverlight2.0.31005.0npctrl.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-22 22:41:11
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.

---

Other Running Processes

---

.
c:windowssystem32WgaTray.exe
c:progra~1COMMON~1NokiaMPAPIMPAPI3s.exe
c:program filesICQ6ToolbarICQ Service.exe
c:program filesNetwork AssociatesCommon FrameworkFrameworkService.exe
c:program filesNetwork AssociatesVirusScanMcshield.exe
c:progra~1NETWOR~1COMMON~1naPrdMgr.exe
c:program filesNetwork AssociatesVirusScanVsTskMgr.exe
c:program filesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
c:windowssystem32nvsvc32.exe
c:windowssystem32PnkBstrA.exe
c:windowssystem32wscntfy.exe
c:program filesCommon FilesPCSuiteServicesServiceLayer.exe
.
**************************************************************************
.
Completion time: 2008-12-22 22:42:51 — machine was rebooted
ComboFix-quarantined-files.txt 2008-12-22 18:42:06
ComboFix2.txt 2008-12-14 17:53:55
ComboFix3.txt 2008-12-09 19:30:50
ComboFix4.txt 2008-12-08 18:22:57
ComboFix5.txt 2008-12-22 18:38:11

Pre-Run: 14 920 974 336 байт свободно
Post-Run: 14,958,624,768 байт свободно

201 — E O F — 2008-10-24 18:01:10

[Admin]

Лог выглядит нормально.
Удалите с корня диска C файл n1deiect.com.
Как работает компьютер ? Всё нормально ?

[catanddog06]

Я не смогла найти файл n1deiect.com. на диске С. В скрытых папках я тоже смотрела. Как же его найти? И поисковик не находит. Может, его нет?

[Admin]

Удалим n1deiect.com в автоматическом режиме.
Откройте блокнот и вставьте в него следующий текст:

File::

C:n1deiect.com

Запишите получившийся файл на ваш рабочий стол под именем CFScript.
Далее перетащите получившийся файл на иконку Combofix.

Вставьте в свой ответ Combofix лог.

[catanddog06]

Все сделала, Лог получился:

ComboFix 08-12-14.01 — 1 2008-12-27 0:03:08.8 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1251.1.1049.18.511.170 [GMT 4:00]
Running from: c:documents and settings1Рабочий столComboFix.exe
Command switches used :: c:documents and settings1Рабочий столCFScript.txt
* Created a new restore point
* Resident AV is active

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
— REDUCED FUNCTIONALITY MODE —

FILE ::
C:n1deiect.com
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:n1deiect.com

.
((((((((((((((((((((((((( Files Created from 2008-11-26 to 2008-12-26 )))))))))))))))))))))))))))))))
.

2008-12-10 19:21 . 2008-12-10 19:21 796 —a

---

C:top100.cnt
2008-12-09 22:15 . 2008-12-09 22:15 d

---

c:program filesICQ6Toolbar
2008-12-09 22:15 . 2008-12-09 22:15 d

---

c:documents and settingsAll UsersApplication DataICQ
2008-12-09 22:12 . 2008-12-09 22:23 d

---

c:program filesICQ6.5
2008-12-09 22:12 . 2008-12-13 19:12 d

---

c:documents and settings1Application DataICQ
2008-12-08 00:28 . 2008-12-08 00:28 d

---

c:documents and settingsЂ¤¬Ё­Ёбва в®а
2008-12-07 23:08 . 2008-12-07 23:08 d

---

c:program filesParagon Software
2008-12-07 23:08 . 2008-12-07 23:08 d

---

c:program filesCommon FilesParagon Software
2008-12-07 21:31 . 2008-12-07 21:36 d

---

c:program filesTranslateIt! 6.5
2008-12-07 21:31 . 2008-12-07 21:31 d

---

c:documents and settings1Application DataTranslateIt6.5
2008-12-05 21:35 . 2008-12-05 23:01 d

---

c:program filesГДЗометр 2.1
2008-12-03 22:40 . 2008-12-03 22:40 d

---

c:program filesVerseQ
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program filesUltraISO
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program filesSmart Install Maker
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program filesLouderIt
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program filesDAEMON Tools
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program filesCommon FilesEZB Systems
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program filesAudiograbber
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:program files7-Zip
2008-11-28 23:35 . 2008-11-28 23:35 d

---

c:documents and settings1Application DataDAEMON Tools
2008-11-28 23:35 . 2001-08-17 14:53 62,976 —a

---

c:windowssystem32CABARC.EXE
2008-11-28 23:35 . 2007-10-31 20:42 8,636 —a

---

c:windowssystem32MODIFYPE.EXE
2008-11-28 23:35 . 2007-11-08 15:44 2,130 —a

---

c:windowssystem32CABTOOLS.VBS
2008-11-28 23:35 . 2004-09-28 20:26 1,701 —a

---

c:windowssystem32CABIN.VBS
2008-11-28 23:35 . 2004-09-27 20:57 1,281 —a

---

c:windowssystem32CABOUT.VBS
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesRestorator 2007
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesNeoSmart Technologies
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesFSImgViewer
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesEverest
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesEasy Gif Animator
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesDriver-soft
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:program filesCPU-Z
2008-11-28 23:34 . 2008-11-28 23:34 d

---

c:documents and settings1Application DataFastStone
2008-11-28 23:34 . 2007-03-11 21:29 116,736 —a

---

c:windowssystem32RestoratorContextMenu.dll
2008-11-28 23:33 . 2008-11-28 23:33 d

---

c:program filesCorel
2008-11-28 23:33 . 2008-11-28 23:33 d

---

c:program filesCommon FilesCorel
2008-11-28 23:30 . 2008-11-28 23:30 d

---

c:program filesTechSmith
2008-11-28 23:30 . 2008-11-28 23:30 d

---

c:documents and settingsAll UsersApplication DataTechSmith
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesXPTweaker
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesUninstall Tool
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesRegshot
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesReal Alternative
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesNo1 DVD Ripper
2008-11-28 23:29 . 2007-07-09 17:40 d

---

c:program filesKristanix
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesK-Lite Codec Pack
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesCommon FilesWise Installation Wizard
2008-11-28 23:29 . 2008-11-28 23:29 d

---

c:program filesCcleaner
2008-11-28 23:28 . 2008-11-28 23:28 d

---

c:program filesVLC
2008-11-28 23:28 . 2008-11-28 23:28 d

---

c:program filesThe KMPlayer
2008-11-28 23:28 . 2008-11-28 23:28 d

---

c:program filesMSECache
2008-11-28 23:27 . 2008-11-28 23:27 d

---

c:program filesCommon FilesMacromedia
2008-11-28 23:27 . 2008-11-28 23:48 d

---

c:program filesCommon FilesArsenal Shared
2008-11-28 23:27 . 2008-11-28 23:28 d

---

c:program filesArsenal Company
2008-11-28 23:25 . 2008-11-28 23:25 d

---

c:program filesMacromedia
2008-11-28 23:17 . 2008-11-28 23:24 d

---

c:windowsSHELLNEW
2008-11-28 23:15 . 2008-11-28 23:15 d

---

c:program filesMicrosoft Works
2008-11-28 23:13 . 2008-11-28 23:25 d

---

c:documents and settingsAll UsersApplication DataMicrosoft Help
2008-11-28 23:12 . 2008-11-28 23:12 dr-h

---

C:MSOCache
2008-11-28 23:11 . 2008-11-28 23:11 d

---

c:program filesWinDjView
2008-11-28 23:11 . 2008-11-28 23:42 d

---

c:program filesPunto Switcher
2008-11-28 23:11 . 2008-11-28 23:11 d

---

c:program filesFoxit Reader
2008-11-27 21:48 . 2008-11-27 23:36 d

---

c:windowssystem32CatRoot_bak
2008-11-27 21:25 . 2008-11-27 21:25 d

---

c:program filesMicrosoft Silverlight
2008-11-27 20:20 . 2004-12-22 13:06 17,584,128 -ra

---

c:windowssystem32ALSNDMGR.CPL
2008-11-27 20:20 . 2004-12-22 13:13 9,524,224 -ra

---

c:windowssystem32RTLCPL.EXE
2008-11-27 20:20 . 2004-12-22 13:07 2,304,320 -ra

---

c:windowssystem32driversALCXWDM.SYS
2008-11-27 20:20 . 2004-09-07 10:23 156,672 -ra

---

c:windowssystem32RTLCPAPI.dll
2008-11-27 20:20 . 2002-02-05 09:54 141,016 -ra

---

c:windowssystem32ALSNDMGR.WAV
2008-11-27 20:20 . 2004-12-22 13:09 77,824 -ra

---

c:windowsSOUNDMAN.EXE
2008-11-27 20:09 . 2008-11-27 20:09 d

---

c:documents and settingsAll UsersApplication DataNetwork Associates
2008-11-27 20:08 . 2008-11-27 20:09 d

---

c:program filesNetwork Associates
2008-11-27 20:08 . 2008-11-27 20:08 d

---

c:program filesCommon FilesNetwork Associates
2008-11-27 19:47 . 2008-11-27 19:48 d

---

c:program filesWinamp
2008-11-27 19:17 . 2008-11-27 19:30 d

---

c:windowsSxsCaPendDel
2008-11-27 19:11 . 2008-11-29 13:28 d

---

c:program filesMario Forever
2008-11-27 17:24 . 2008-11-27 17:24 4,444 —a

---

c:windowssystem32pid.PNF

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-09 18:15

---

d—h—w c:program filesInstallShield Installation Information
2008-12-09 17:43

---

d

---

w c:program filesQIP
2008-11-28 19:31

---

d

---

w c:program filesCommon FilesAdobe
2008-11-27 15:47

---

d

---

w c:program filesDownload Master
2008-11-27 15:36

---

d

---

w c:program filesNokia
2008-11-27 15:31

---

d

---

w c:program filesMail.Ru
2008-11-27 15:30 96,256 —-a-w c:windowssystem32driverssptd5581.sys
2008-11-27 15:28

---

d

---

w c:program filescitysvyaz
2008-11-27 15:27

---

d

---

w c:program filesPPPWorld
2008-11-27 15:27

---

d

---

w c:program filesDivX
2008-11-27 15:26

---

d

---

w c:program filesXtra
2008-11-27 15:19

---

d

---

w c:program filesOpera
2008-11-27 15:05

---

d

---

w c:program filesInterActual
2008-11-27 15:04

---

d

---

w c:program filesInterVideo
2008-11-27 15:04

---

d

---

w c:program filesCommon FilesInterVideo
2008-11-27 15:01

---

d

---

w c:program filesASUSTek
2008-11-14 20:35

---

d

---

w c:documents and settingsAll UsersApplication DataAlawarWrapper
2008-11-14 13:54

---

d

---

w c:program filesAlawar.ru
2008-11-14 13:25

---

d

---

w c:documents and settings1Application DataEleFun Games
2008-10-16 10:13 202,776 —-a-w c:windowssystem32wuweb.dll
2008-10-16 10:13 1,809,944 —-a-w c:windowssystem32wuaueng.dll
2008-10-16 10:12 561,688 —-a-w c:windowssystem32wuapi.dll
2008-10-16 10:12 323,608 —-a-w c:windowssystem32wucltui.dll
2008-10-16 10:09 92,696 —-a-w c:windowssystem32cdm.dll
2008-10-16 10:09 51,224 —-a-w c:windowssystem32wuauclt.exe
2008-10-16 10:09 43,544 —-a-w c:windowssystem32wups2.dll
2008-10-16 10:08 34,328 —-a-w c:windowssystem32wups.dll
2008-10-16 10:06 268,648 —-a-w c:windowssystem32mucltui.dll
2008-10-16 10:06 208,744 —-a-w c:windowssystem32muweb.dll
2008-10-15 17:00 332,800 —-a-w c:windowssystem32dllcachenetapi32.dll
2008-09-30 12:43 1,286,152 —-a-w c:windowssystem32msxml4.dll
2006-02-23 20:00 4,400,769 —-a-w c:program files3gp-video-converter.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2004-08-17 15360]
«NBJ»=»c:program filesaheadNero BackItUpNBJ.exe» [2004-09-07 1871872]
«MSMSGS»=»c:program filesMessengermsmsgs.exe» [2004-10-13 1694208]
«Download Master»=»c:program filesDownload Masterdmaster.exe» [2007-09-12 3253248]
«PcSync»=»c:program filesNokiaNokia PC Suite 6PcSync2.exe» [2006-06-27 1449984]
«Punto Switcher»=»c:program filesPunto Switcherps.exe» [2007-11-14 201728]
«louderit.exe»=»c:program fileslouderitLouderIt.exe» [2008-02-19 41472]
«SlovoEd 6″=»c:program filesParagon SoftwareSlovoEd 6run.exe» [2007-03-26 610304]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«NeroFilterCheck»=»c:windowssystem32NeroCheck.exe» [2001-07-09 155648]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2005-06-15 6803456]
«PCSuiteTrayApplication»=»c:progra~1NokiaNOKIAP~1LAUNCH~1.EXE» [2006-06-15 229376]
«WinampAgent»=»c:program filesWinampwinampa.exe» [2006-02-23 35328]
«ShStatEXE»=»c:program filesNetwork AssociatesVirusScanSHSTAT.EXE» [2003-09-29 81990]
«McAfeeUpdaterUI»=»c:program filesNetwork AssociatesCommon FrameworkUpdaterUI.exe» [2003-09-10 135251]
«nwiz»=»nwiz.exe» [2005-06-15 c:windowssystem32nwiz.exe]
«SoundMan»=»SOUNDMAN.EXE» [2004-12-22 c:windowsSOUNDMAN.EXE]

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\QIP\qip.exe»=
«c:\Program Files\ICQ6.5\ICQ.exe»=

R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);c:windowssystem32driverssfsync03.sys [2005-12-06 35328]
R0 tffsport;M-Systems DiskOnChip 2000;c:windowssystem32DRIVERStffsport.sys [2008-10-28 149376]
R2 ICQ Service;ICQ Service;c:program filesICQ6ToolbarICQ Service.exe [2008-12-09 222456]
S3 ASPI;Advanced SCSI Programming Interface Driver;??c:windowsSystem32DRIVERSASPI32.sys [2008-02-04 16512]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2F]
ShellAutoRuncommand — F:laucher.exe

*Newly Created Service* — CATCHME
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://www.yandex.ru/?clid=40488
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~4Office12EXCEL.EXE/3000
IE: Закачать ВСЕ при помощи Download Master — c:program filesDownload Masterdmieall.htm
IE: Закачать при помощи Download Master — c:program filesDownload Masterdmie.htm
IE: {{8DAE90AD-4583-4977-9DD4-4360F7A45C74} — c:program filesDownload Masterdmaster.exe
IE: {{8DAE90AD-4583-4977-9DD4-4360F7A45C74} — c:program filesDownload Masterdmaster.exe —
TCP: {ECABB36C-1AA3-40EC-AE20-2881C213519F} = 85.113.62.225 85.113.63.225
FF — ProfilePath — c:documents and settings1Application DataMozillaFirefoxProfilesh3beukur.default
FF — prefs.js: browser.search.selectedEngine — ICQ Search
FF — prefs.js: browser.startup.homepage — hxxp://www.yandex.ru/?clid=40488
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnppl3260.dll
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnprpjplug.dll
FF — plugin: c:program filesMicrosoft Silverlight2.0.31005.0npctrl.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-27 00:03:46
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-12-27 0:04:57
ComboFix-quarantined-files.txt 2008-12-26 20:04:23
ComboFix2.txt 2008-12-22 18:42:54
ComboFix3.txt 2008-12-14 17:53:55
ComboFix4.txt 2008-12-09 19:30:50
ComboFix5.txt 2008-12-26 20:02:29

Pre-Run: 14 906 908 672 байт свободно
Post-Run: 14,911,188,992 байт свободно

201 — E O F — 2008-10-24 18:01:10

[Admin]

Лог выглядит хорошо.
Как поживает ваш компьютер ?

[catanddog06]

Все хорошо!Спасибо Вам огромное!С Наступающим!

[Admin]

Спасибо за поздравление. Вас так же с наступающим новым годом!

Несколько завершающих действий.

Удалите Combofix с вашего компьютера, действуйте согласно инструкции: Как правильно удалить combofix с компьютера.

Запустите программу OTMoveIT3. Кликните по кнопке CleanUp. Если появится запрос на перезагрузку компьютера, то кликните Да/Yes.
Так же удалите другие сканеры и небольшие утилиты, а так же все файлы и каталоги который были созданы в процессе лечения компьютера.

Установите программу Spybot Search and Destroy, это довольно неплохая дополнительная защита.

Удалите старые точки восстановления, так как в них возможно нахождения инфицированных файлов, троянов и других вредоносных программ. Для этого кликните по иконке Мой компьютер, выберите пункт Свойства. В открывшемся окне выберите вкладку Восстановление системы. Поставьте галочку напротив пункта Отключить восстановление системы на всех дисках. Кликните по кнопке Применить. Подтвердите свои действия кликнув по кнопке OK в открывшемся диалоге. Закройте окно Свойства системы, кликнув по кнопке OK.

После загрузки компьютера выполните действия описанные выше, только в этот раз снимите галочку.

Создайте новую точку восстановления. Это поможет вам в случае необходимости загрузить текущую конфигурацию Windows и быстро излечиться от спайваре/вируса. Для этого кликните по кнопке Пуск, далее выберите пункт Стандартные, в нём Служебные и запустите программу Восстановление системы. В открывшемся окне выберите задачу Создать точку восстановления и нажмите кнопку Далее и следуйте указаниям.

Не забывайте обновлять Windows, ваши программы и особенно ваш антивирус.

Всего доброго!

[Автор]

Сообщения